CVE-2006-5752: Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (ht...

Security readout for executives and security teams

This is an old Apache HTTP Server mod_status cross-site scripting issue. It matters mainly if the server-status page is publicly reachable and ExtendedStatus is enabled. In that case, a remote attacker may cause script or HTML to run in a browser viewing the status page under charset-detection conditions. Exposure is most likely on Apache httpd deployments that publish mod_status server-status pages to unauthenticated users while ExtendedStatus is enabled. Internal-only status pages reduce business exposure but may still matter for administrators or monitoring users viewing the page in affected browser conditions. Prioritize remediation for externally reachable Apache status pages. This is not evidenced as actively exploited in the bundle, but public diagnostic pages can expose operational details and create browser-side risk for administrators. Mitigation focus: Restrict server-status access to trusted administrative networks or authenticated users.; Disable ExtendedStatus unless it is operationally required.; Check Apache package guidance from your OS or appliance vendor..

Prepared

Jun 29, 2026, 04:47 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.